CVE-2026-12921: AzeoTech DAQFactory Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-12921 is a use-after-free (CWE-416) memory corruption vulnerability in DAQFactory's .ctl file parsing logic. The vulnerability allows an attacker to craft a malicious control file that, when opened in a vulnerable version of DAQFactory, causes the application to reference memory that has already been freed. By controlling the contents and timing of memory operations, an attacker can overwrite freed memory regions with shellcode or redirect execution flow, achieving arbitrary code execution. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack surface, low complexity, required user interaction, and full confidentiality, integrity, and availability impact.

Business impact

DAQFactory is commonly used in industrial automation, data acquisition, and process control environments. Successful exploitation could allow an attacker to gain code execution on systems running vulnerable versions, potentially leading to theft of process data, manipulation of control logic, system unavailability, or lateral movement within operational technology (OT) networks. Organizations relying on DAQFactory for mission-critical monitoring or control should prioritize assessment and patching to prevent compromise of production systems.

Affected systems

AzeoTech DAQFactory versions 21.1 and prior are affected. Organizations should inventory all DAQFactory deployments and identify systems running version 21.1 or earlier. Verify the exact version in use through the application's About dialog or version check feature, and confirm whether .ctl files are imported from untrusted sources or user-accessible locations.

Exploitability

Exploitation requires local system access and user interaction—specifically, the victim must open a malicious .ctl file. This limits the attack scope to scenarios where an attacker can deliver a crafted file via email, file sharing, or compromised repositories. The vulnerability is not remotely exploitable without prior system access. Once a user opens the malicious file, code execution occurs with the privileges of the DAQFactory process, typically a standard user account.

Remediation

The primary remediation is to upgrade AzeoTech DAQFactory to a version that patches this use-after-free vulnerability. Verify the patched version number against the official AzeoTech advisory. Until patching is possible, implement compensating controls: restrict .ctl file import to trusted, authenticated sources; educate users not to open .ctl files from unknown origins; and consider disabling .ctl file loading if not operationally necessary. On air-gapped or isolated systems, the risk is substantially lower but should not be ignored if OT personnel receive files from external parties.

Patch guidance

Check the AzeoTech website and vendor security advisories for the specific patch version that addresses CVE-2026-12921. Apply patches in a controlled manner: test in a non-production environment first, plan downtime if required, and verify DAQFactory functionality post-patch. If using DAQFactory in a production OT environment, coordinate patching with operational windows to minimize disruption. Document the patch level and maintain an asset inventory for future vulnerability tracking.

Detection guidance

Monitor for suspicious .ctl file access or parsing attempts in DAQFactory logs and process execution traces. Look for unexpected child processes spawned by DAQFactory, abnormal memory patterns, or crashes followed by malicious activity. On systems with endpoint detection and response (EDR) tools, create detections for DAQFactory process crashes or anomalous execution flow. Network-based detection is limited since the vulnerability is local; focus on host-based signals and file integrity monitoring on .ctl file locations. Collect process memory dumps from crashed instances for forensic analysis if a compromise is suspected.

Why prioritize this

This vulnerability merits high priority due to its combination of HIGH severity (CVSS 7.8), code execution impact, and potential targeting of OT/industrial environments where process control systems are critical. Although user interaction is required, social engineering can be effective in industrial settings. The use-after-free class of vulnerability can be difficult to patch comprehensively if the underlying memory management is not refactored, raising the risk of similar issues. Early patching and user training reduce risk significantly.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) local attack vector—requires access to the targeted system; (2) low attack complexity—no special conditions needed beyond opening a file; (3) no privileges required to trigger the vulnerability; (4) required user interaction—user must open the crafted .ctl file; (5) unchanged scope—impact is limited to the vulnerable component; and (6) high impact on confidentiality, integrity, and availability—code execution grants the attacker full control over the application process. Organizations in regulated industries (e.g., manufacturing, energy) should treat this as a priority patch.

Frequently asked questions